annual report 2016-2017 1 - public prosecution service of canada · 2017. 8. 16. · the ppsc...

Public Prosecution Service of Canada Privacy Act Annual Report 2016-2017 1

TABLE OF CONTENTS

Introduction .................................................................................................................................................. 2

The Public Prosecution Service of Canada .................................................................................................... 2

Commissioner of Canada Elections ............................................................................................................... 3

Access to Information and Privacy (ATIP) Office .......................................................................................... 3

Delegated Authorities ................................................................................................................................... 4

Interpretation of the Statistical Report ........................................................................................................ 5

Requests Under the Privacy Act .......................................................................................................... 5

Requests Closed During the Reporting Period .................................................................................... 5

Disposition of requests ............................................................................................................... 5

Completion time ......................................................................................................................... 6

Exemptions ................................................................................................................................. 6

Exclusions .................................................................................................................................... 7

Format of information released .................................................................................................. 7

Complexity .................................................................................................................................. 7

Deemed refusals ......................................................................................................................... 7

Requests for translation .............................................................................................................. 7

Requests for Correction of Personal Information and Notations ....................................................... 8

Extensions ........................................................................................................................................... 8

Reason for extensions ................................................................................................................. 8

Length of extensions ................................................................................................................... 8

Consultations Received from Other Institutions and Organizations .................................................. 8

Number of consultations ............................................................................................................ 8

Sources of consultations ............................................................................................................. 8

Number of Pages Reviewed ....................................................................................................... 8

Recommendations ...................................................................................................................... 9

Completion time ......................................................................................................................... 9

Completion Time of Consultations on Cabinet Confidences .............................................................. 9

Resources Related to the Privacy Act ................................................................................................. 9

Training Activities ........................................................................................................................................ 10

Policies, Guidelines, Procedures, and Initiatives ........................................................................................ 10

Complaints, Audits, and Investigations ....................................................................................................... 10

Court Action ................................................................................................................................................ 11

Monitoring Compliance ............................................................................................................................. 11

Material Privacy Breaches........................................................................................................................... 12

Privacy Impact Assessments ...................................................................................................................... 12

Public Interest Disclosure............................................................................................................................ 12

Appendix A – Delegation Order .................................................................................................................. 13

Appendix B – Statistical Report on the Privacy Act ..................................................................................... 14


INTRODUCTION

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy

of individuals with respect to personal information about themselves held by government institutions and

to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an

independent organization on December 12, 2006, with the coming into force of the Director of Public

Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, the PPSC has prepared this 2016-2017 Annual Report on the Privacy Act

for tabling in the House of Commons and the Senate. This Report provides an analysis of the information

contained in the PPSC’s Statistical Report on the Privacy Act. In addition, it reports on emerging trends,

training activities and newly implemented or revised internal policies, guidelines and procedures with

respect to the PPSC’s administration of the Act.

THE PUBLIC PROSECUTION SERVICE OF CANADA

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the

Director of Public Prosecutions (DPP) as Deputy Attorney General of Canada to:

- initiate and conduct federal prosecutions;

- intervene in proceedings that raise a question of public interest that may affect the conduct of

prosecutions or related investigations;

- issue guidelines to federal prosecutors;

- advise law enforcement agencies or investigative bodies on general matters relating to

prosecutions and on particular investigations that may lead to prosecutions;

- communicate with the media and the public on all matters that involve the initiation and conduct

of prosecutions;

- exercise the authority of the Attorney General of Canada in respect of private prosecutions; and

- exercise any other power or carry out any other duty or function assigned by the Attorney General

of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

- initiate and conduct prosecutions under the Canada Elections Act; and

- act, when requested by the Attorney General of Canada, in matters under the Extradition Act and

the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department, and in this capacity is responsible for

the management of the PPSC as a distinct governmental organization.


COMMISSIONER OF CANADA ELECTIONS

The Commissioner of Canada Elections (CCE) is responsible for ensuring that the Canada Elections Act and

the Referendum Act are complied with and enforced. While the CCE is part of the PPSC, it remains

operationally independent.

All privacy requests and consultations regarding the Office of the CCE are processed by the PPSC’s Access

to Information and Privacy Office.

ACCESS TO INFORMATION AND PRIVACY (ATIP) OFFICE

The ATIP Office holds primary responsibility for the implementation and administration of the Act. The Office deals directly with the public in relation to privacy requests, liaises with Offices of Primary Interest to prepare responses, and serves as the centre of expertise for ATIP within the PPSC.

The ATIP Office fulfills its responsibilities by:

- processing requests for personal information in accordance with the Act, its Regulations and the

Treasury Board Secretariat of Canada (TBS)’s policies, directives and guidelines;

- responding to consultations submitted by other federal institutions or other levels of government

on PPSC records being considered for release;

- providing advice to PPSC managers and employees regarding the application and interpretation of

the Act, its Regulations and relevant case law;

- responding to requests received from other federal institutions for the review of solicitor-client

privilege in records related to criminal proceedings in which the PPSC is involved;

- reviewing PPSC policies, procedures and agreements to ensure that they comply with the

requirements of the Act and making recommendations for amendments;

- monitoring the PPSC’s compliance with the Act, its Regulations and the TBS’s policies, directives

and guidelines;

- communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve

complaints filed against the PPSC;

- reviewing documents relevant to proactive disclosure, such as audits and evaluations and

contracts over $25,000 prior to their publication on the PPSC’s website, in order to ensure that

they do not contain personal information;

- delivering training sessions intended to familiarize PPSC managers and employees with the

requirements of the Act, its Regulations and the TBS’s policies, directives and guidelines;

- updating the PPSC’s chapter of the federal government’s Info Source publication;

- submitting an annual statistical report on the administration of the Act to the TBS; and

- preparing an annual report on the administration of the Act for tabling in both Houses of

Parliament.


Organization Structure

As of March 31, 2016, the ATIP Office is composed of a Manager, a Senior Advisor, two Advisors and one

Junior Analyst. The Director, Corporate Planning and External Relations Division, is the organization’s ATIP

Coordinator. Counsel for the Corporate Planning and External Relations Division provides legal advice to

the ATIP Coordinator, the ATIP Office and PPSC managers on the application and interpretation of the Act

and relevant case law. During this fiscal year, the ATIP Office had the additional support of a student.

DELEGATED AUTHORITIES

Pursuant to section 73 of the Act, the head of a government institution may, by order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties of function of the head of the institution under the Act.

The DPP, as the “head of institution”, has designated the authority to exercise the powers and to perform the duties and functions conferred to him under the Act to the Director, Corporate Planning and External Relations Division, and the ATIP Manager (see Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Director.

ATIP Coordinator

Counsel ATIP Manager

JJunior ATIP Analyst

ATIP AdvisorATIP AdvisorSenior ATIP Policy

and Operations Advisor


INTERPRETATION OF THE STATISTICAL REPORT

The following section provides a summary and analysis of the information contained in the Statistical

Report on the Privacy Act in Appendix B of this report.

Requests Under the Privacy Act

The PPSC received 23 new requests for personal information in 2016-2017, which represents a 64%

increase compared to the number of requests received during the previous reporting period. Six (6)

additional requests were carried forward from fiscal year 2015-2016.

The number of requests varies from year to year. The 23 privacy requests received by the PPSC during

this reporting period represents an all-time high for the organization.

Requests Closed During the Reporting Period

Disposition of requests

The PPSC responded to 20 requests for personal information during the 2016-2017 reporting period. A

total of 1,475 pages were reviewed, representing a 10% decrease in volume from the previous reporting

period. This decrease may be attributable to nine (9) requests for personal information having been

carried over to the following reporting period that involved a large volume of pages.

Disposition of the 20 completed requests are broken down as follows:

Requests which resulted in no disclosure of records fell into the following categories: No Records Exist

A total of six (6) requests could not be processed as no relevant records existed under the control of

the PPSC. Where possible, applicants were advised of other government institutions that may have

records and provided with the contact information of those institutions for the purpose of submitting

a request.

10%

50%

30%

10%

All Disclosed (2)

Disclosed in part (10)

No records exist (6)

Request abandoned (2)


Request abandoned

In addition, two (2) requests were abandoned by the applicants. In most cases, receipt of

clarification from applicants was necessary. Where no clarification was provided, the applicant’s

request was deemed abandoned.

Completion time

The chart below represents a breakdown of the length of time (in days) required to process requests for

personal information during the 2016-2017 reporting period.

Of the 20 requests that were completed during fiscal year 2016-2017, 15 were processed within the 30-day statutory response period. Three (3) requests were responded to within 31 to 60 days, and two (2) requests required 61 to 120 days to complete.

Over the last five (5) reporting periods, 76% of the PPSC’s requests for personal information were responded to within the 30-day statutory deadline.

Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions that were applied by the PPSC during the 2016-2017 reporting period:

25%

50%

15%

10%1 to 15 days (5)

16 to 30 days (10)

31 to 60 days (3)

61 to 120 days (2)

0

5

10

s. 19(1)(d)s. 22(1)(b)

s. 26s.27

11

9

3

TIm

es

Exe

mp

tio

ns

Ap

plie

d

Exemptions


Over the last five (5) reporting periods, section 26 [Information about another individual] and section 27 [Solicitor-client privilege] of the Act are the exemptions that were most often applied. This reflects the mandate of the PPSC which is to conduct federal prosecutions and advise law enforcement agencies and investigative bodies on matters relating to prosecutions.

The PPSC records often contain a significant amount of personal information, including information about accused, witnesses, and victims.

Exclusions

Records or parts thereof to which the Act does not apply are considered to be “excluded”. Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record, and material placed in Library and Archives Canada. Records containing Confidences of the Queen's Privy Council for Canada that have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

During the 2016-2017 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the PPSC.

Format of information released

For responses in which information was disclosed, the information was provided to the applicant electronically by e-mail or on a compact disk in 42% of cases. Paper copies of records were provided in 58% of cases.

Complexity

The mandate of the PPSC is to prosecute offences under federal jurisdiction and to provide advice on prosecution-related matters to investigative agencies. Due to the nature of the organization’s work, processing privacy requests can be challenging. Records held by the PPSC often contain information relating to criminal or regulatory investigations or prosecutions that also frequently involve other organizations and government departments at the federal, provincial or territorial level.

During the 2016-2017 reporting period, the PPSC consulted with other government institutions on two (2) occasions. Legal advice was sought in order to respond to two (2) requests. Nine (9) requests were also considered complex due to the personal information of another individual being intermixed with the information of the applicant. In three (3) instances, the PPSC retrieved records from its regional offices and/or dealt with a request related to a high-profile matter.

Deemed refusals

The PPSC was in deemed refusal on one (1) occasion during the 2016-2017 reporting period due to the large volume of records that required processing. For this request, no extension was taken and the PPSC was unable to complete the processing of the request within the 30-day time period.

Requests for translation

The PPSC received no requests from applicants for translation from one official language to the other.


Requests for Correction of Personal Information and Notations

Paragraph 12(2)(a) of the Act provides that every individual who is given access to personal information about themselves that has been used, is being used, or is available for use for an administrative purpose (i.e. in a decision making process that directly affects the individual) is entitled to request correction of the information where the individual believes there is an error or omission.

There were no requests for correction of personal information nor were notations required during this reporting period.

Extensions

Paragraph 15(a) of the Act allows for an extension of the 30-day statutory time limit for a maximum of 30 days in cases where meeting the original time limit would unreasonably interfere with the operations of the institution processing the request, or when consultations with other government institutions are necessary and cannot reasonably be completed within the original time limit.

Reason for extensions

A total of three (3) extensions were taken during the 2016-2017 reporting period. In one (1) instance, the extension was sought on the basis that meeting the original time limit would unreasonably interfere with the operations of the PPSC. In two (2) instances, the extension was sought on the basis that consultations were necessary to comply with the request as it could not reasonably be completed within the original time limit.

Length of extensions

All of the extensions taken during the reporting period were for a duration of 16 to 30 days.

Consultations Received from Other Institutions and Organizations

Number of consultations

The PPSC received two (2) privacy consultations in 2016-2017, which is a 71% decrease in the number of consultations received during the previous reporting period.

Sources of consultations

Health Canada (HC) and Environment and Climate Change Canada (ECCC) each sent one (1) consultation to the PPSC during this reporting period. Number of Pages Reviewed

Although the number of privacy consultations the PPSC responded to in the 2016-2017 fiscal year decreased in comparison to the last five (5) reporting periods, the PPSC reviewed an all-time organizational high of 1776 pages this reporting period.


The following is a breakdown of the number of pages for privacy consultations that the PPSC has reviewed during each of the last five (5) reporting periods:

Recommendations

The PPSC made recommendations to disclose all records for one (1) of the two consultations. It was unable to process the other consultation as the records received were not relevant to the PPSC.

The PPSC’s disclosure rates in 2016-2017 have decreased in comparison to the average rate of the five (5) previous years, which is likely attributable to the decrease in consultations received during this reporting period. During the period covering fiscal years 2012-2013 to 2016-2017, the PPSC processed a total of 42 consultations. In 80% of those cases, the PPSC recommended that information be released in whole or in part. During 2016-2017, full or partial disclosure of information was recommended in 50% of cases.

Completion time

Of the two (2) consultations that were completed, both were responded to within 15 days or less.

Over the last five (5) reporting periods, 83% of privacy consultations received by the PPSC were responded to within 30 days. From 2012-2013 to 2016-2017, 56% of consultations completed were processed in 15 days or less while an additional 29% were completed within 16 to 30 days.

Completion Time of Consultations on Cabinet Confidences

No consultations on the application of section 70 [Cabinet confidences] of the Act were carried out during

the 2016-2017 reporting period.

Resources Related to the Privacy Act

During this reporting period, the PPSC spent a total of $225, 444 to administer the Act, of which salaries accounted for $165, 572 and Goods and Services accounted for $59, 872. No overtime expenditures were incurred.

0

500

1000

1500

2000

2012-20132013-2014

2014-20152015-2016

2016-2017

591323

30950

1776

Pag

es

Re

vie

we

d

Fiscal Years


TRAINING ACTIVITIES

The ATIP Office provides advice on a regular basis to PPSC officials regarding the processing of privacy

requests and interpretation of the Act to ensure the efficient and consistent processing of requests

received by the PPSC.

ATIP personnel also provided informal training to employees on various privacy-related matters at times throughout the reporting period.

During this reporting period, the ATIP Office provided a training and awareness session regarding the

PPSC’s processes and employee obligations under the Act to approximately six (6) employees of the PPSC’s

Labour Relations and Classification Sections of Human Resources.

POLICIES, GUIDELINES, PROCEDURES, AND INITIATIVES

ATIP Governance Structure

The PPSC ATIP Governance Structure was approved by the PPSC’s Executive Council in October 2011. The

Governance Structure outlines the reporting relationships within the PPSC and establishes clear

responsibilities for decision-making for the purposes of administering the Act.

Info Source

Info Source is published on the Open Government Portal and provides information about the functions,

programs, activities and related information holdings of government institutions subject to the Access to

Information Act and the Privacy Act.

Each year, the ATIP Office provides updates on the PPSC’s activities and information holdings for

publication in Info Source. In 2016-2017, the PPSC’s Info Source chapter was revised to reflect changes

to its Program Alignment Architecture.

Initiatives

The PPSC did not implement any new policies or initiatives related to privacy during the 2016-2017

reporting period. The PPSC expects to develop new and revised policies related to privacy during the next

fiscal year. To assist in this endeavor, the PPSC’s ATIP Office is in the process of staffing a full-time ATIP

Policy and Operations Advisor.

COMPLAINTS, AUDITS, AND INVESTIGATIONS

Decisions made under the Act are subject to a two-tiered system of review. The first level of review is a formal complaint to the Office of the Privacy Commissioner of Canada (OPC); the second level is an application for judicial review to the Federal Court.

A total of three (3) complaints were filed with the OPC against the PPSC during the 2016-2017 reporting

period. The PPSC received findings or recommendations from the Commissioner in connection with one

(1) of these complaints during this reporting period. Three (3) additional complaints were carried over


from previous reporting periods in which the PPSC received findings or recommendations from the

Commissioner during this reporting period.

The following table is a breakdown of the reasons for the complaints as well as the findings of the OPC’s investigations:

Reason for Complaint

Number of Complaints

Results of OPC Investigations

Well Founded Not Well Founded Discontinued OPC has yet to issue its findings

Refusal/Exemptions 2 2 0 0 0

Extension 0 0 0 0 0

Delay 4 2 0 0 2

With respect to the four (4) well-founded complaints, two were filed by the same applicant alleging that the PPSC improperly applied exemptions. Following discussions with the OPC, the PPSC agreed to resolve the complaints by releasing some additional information to the complainant. The other two (2) complaints were a result of delay. Due to the large volume of records involved, the PPSC was unable to process the requests within the statutorily prescribed time frame. In accepting the PPSC’s reason for delay, the OPC found the complaints to be well-founded. The PPSC reviews the outcomes of all of the Privacy Commissioner investigations and, where appropriate, incorporates lessons learned into business processes. No audits were received during this reporting period.

COURT ACTION

During this reporting period, no application for judicial review was filed with the Federal Court pursuant to section 41 of the Act with respect to privacy requests submitted to the PPSC.

MONITORING COMPLIANCE

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. Monthly reports are provided to the ATIP Coordinator identifying the number of active privacy requests, the sources and due dates of the requests, as well as the length of any extensions taken.

Information relating to the processing time of requests for correction of personal information is included in the monthly reports.


MATERIAL PRIVACY BREACHES

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention or

disposal of sensitive personal information which could reasonably be expected to cause serious injury or

harm to the individual to whom it relates.

During this reporting period, the ATIP Office received reports of four (4) material privacy breaches. In two

(2) instances, improperly vetted records were inadvertently disclosed. In one (1) case, a vehicle was

broken into and an employee’s laptop containing personal information was stolen. In the last case, an

envelope containing confidential records was improperly addressed and was opened by a person other

than the intended recipient.

The PPSC took immediate steps to mitigate these breaches. In addition, the PPSC reviewed its internal

processes, provided additional training to employees, and reminded employees and agents of their

responsibilities to ensure that such situations do not reoccur.

PRIVACY IMPACT ASSESSMENTS (PIAS)

A Privacy Impact Assessment (PIA) is a tool used to assist an organization to meet its privacy responsibilities with regard to the management of personal information. PIAs are initiated when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

During this reporting period, no PIAs were completed by the PPSC.

PUBLIC INTEREST DISCLOSURES

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the consent of the individual to whom the information pertains.

There were no disclosures made to federal investigative bodies for the purpose of enforcing any law of Canada or a province, or for carrying out a lawful investigation [paragraph 8(2)(e)] in fiscal year 2016-2017, nor were any disclosures made in the public interest [paragraph 8(2)(m)].


APPENDIX A – DELEGATION ORDER


APPENDIX B – STATISTICAL REPORT ON THE PRIVACY ACT

annual report 2016-2017 1 - public prosecution service of canada · 2017. 8. 16. · the ppsc...

Documents